Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GHSA SYNC: 1 brand new advisory #846

Closed
wants to merge 1 commit into from
Closed

GHSA SYNC: 1 brand new advisory #846

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 29 additions & 13 deletions gems/activesupport/CVE-2023-38037.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,31 +7,47 @@ url: https://github.com/rails/rails/releases/tag/v7.0.7.1
title: Possible File Disclosure of Locally Encrypted Files
date: 2023-08-23
description: |
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.
There is a possible file disclosure of locally encrypted files in
Active Support. This vulnerability has been assigned the
CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5
* Versions Affected: >= 5.2.0
* Not affected: < 5.2.0
* Fixed Versions: 7.0.7.1, 6.1.7.5

# Impact
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
ActiveSupport::EncryptedFile writes contents that will be encrypted
to a temporary file. The temporary file’s permissions are defaulted
to the user’s current umask settings, meaning that it’s possible
for other users on the same system to read the contents of the
temporary file.

All users running an affected release should either upgrade or use one of the workarounds immediately.
Attackers that have access to the file system could possibly read
the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use
one of the workarounds immediately.

# Releases

The fixed releases are available at the normal locations.

# Workarounds
To work around this issue, you can set your umask to be more restrictive like this:

```ruby
$ umask 0077
```
To work around this issue, you can set your umask to be more
restrictive like this:

$ umask 0077
cvss_v3: 5.5
unaffected_versions:
- "< 5.2.0"
- "< 5.2.0"
patched_versions:
- "~> 6.1.7, >= 6.1.7.5"
- ">= 7.0.7.1"
- "~> 6.1.7, >= 6.1.7.5"
- ">= 7.0.7.1"
related:
url:
- https://github.com/rails/rails/commit/a21d6edf35a60383dfa6c4da49e4b1aef5f00731
- https://nvd.nist.gov/vuln/detail/CVE-2023-38037
- https://github.com/rails/rails/releases/tag/v7.0.7.1
- https://github.com/rails/rails/commit/a21d6edf35a60383dfa6c4da49e4b1aef5f00731
- https://github.com/advisories/GHSA-cr5q-6q9f-rq6q
Loading